Ofcom Pushes Back Online Safety Act Categorisation Register to July 2026 After Legal Challenge
The full implementation of the UK's landmark Online Safety Act (OSA) has hit a significant roadblock, after the media regulator Ofcom announced a major delay to a critical part of the regime. The public register of categorised services, which will identify the largest and most high-risk online platforms and subject them to the strictest legal duties, will now not be published until July 2026. The delay has been forced in part by a legal challenge from the Wikimedia Foundation, the non-profit organisation behind Wikipedia, creating a fresh headache for a government keen to be seen as a world leader in digital regulation. The move throws the timeline for the rest of the sweeping legislation into disarray and creates further uncertainty for tech firms navigating the complex new rules.
Background
The Online Safety Act, which finally became law in late 2023 after a long and contentious passage through Parliament, is one of the most ambitious attempts by any government to regulate the digital world. Its central aim is to make the UK the "safest place in the world to be online" by imposing a new duty of care on platforms to protect their users from illegal and harmful content. A key mechanism for achieving this is a tiered system of risk. The Act empowers Ofcom to "categorise" services based on their size, user base, and the functionalities they offer. The platforms deemed to pose the highest risk—expected to include social media giants like Meta, TikTok, and YouTube—will be placed into Category 1, 2A, or 2B, triggering a host of additional and more onerous legal obligations.
This categorisation process is therefore the linchpin of the entire regulatory framework. It is the step that determines which companies will face the toughest scrutiny and the most severe potential penalties for non-compliance, which can include fines of up to £18 million or 10% of their global annual revenue. Ofcom had been working towards publishing the final register of these services in the first half of 2026. This would have been the starting gun for the enforcement of the Act's most powerful provisions, covering areas like content moderation, transparency reporting, and the use of user empowerment tools.
However, the process has proven to be far more legally and administratively complex than anticipated. The sheer diversity of the online services that fall within the Act's scope, from massive social networks to smaller forums and search engines, makes a one-size-fits-all approach to risk assessment impossible. The regulator has had to develop a sophisticated methodology for measuring user numbers and identifying high-risk features, a process that has been closely watched and, in some cases, challenged by the industry.
Key Developments
In a revised timeline published this week, Ofcom confirmed that the final categorisation register will be delayed until July 2026. The regulator acknowledged that the delay was partly due to a legal challenge initiated by the Wikimedia Foundation. While the specifics of the legal case are not public, it is understood to relate to the principles of how Ofcom assesses risk and whether its methodology unfairly penalises open, non-profit platforms like Wikipedia. This challenge has forced Ofcom to build more time into its schedule for a "representations process" in early 2026, where companies will have a formal opportunity to challenge their provisional categorisation.
This initial delay has a significant knock-on effect on the rest of the implementation timetable. A major consultation on the additional duties for categorised services, which will set out the detailed rules on transparency reporting, fraudulent advertising, and the provision of user empowerment tools, is now not expected to be launched until the second quarter of 2026. According to the timeline provided by techUK, this consultation will then run for a full year, meaning the final rules in these crucial areas may not be in place until mid-2027. This extends the period of uncertainty for tech firms, who are trying to invest in and design compliance systems without knowing the precise details of what will be required of them.
Alongside these delays, Ofcom is also pushing ahead with the financial underpinnings of the new regime. The OSA fees regime, which will require in-scope companies to pay for the cost of their own regulation, is set to become fully operational in 2026. Ofcom has confirmed that it expects to send out the first invoices for the 2026/27 financial year in the third quarter of 2026. This means that many tech companies will find themselves paying for a regulatory system whose full requirements have not yet been finalised. Further detail is available from techUK's ongoing coverage of the regulatory landscape.
Why It Matters
The delay to the categorisation register is more than just an administrative hiccup; it exposes the immense practical and legal challenges of implementing the Online Safety Act. The government's ambition to create a comprehensive and risk-based system of regulation is laudable, but the reality is proving to be a minefield. The legal challenge from a respected organisation like Wikimedia highlights the tension between protecting users and preserving the principles of a free and open internet. If the regulator's methodology can be successfully challenged by a non-profit, it is almost certain that the major for-profit tech giants, with their vast legal resources, will be scrutinising every decision Ofcom makes. For the tech industry, this prolonged uncertainty is a significant problem. Compliance with the OSA will require substantial investment in new systems, processes, and staff. Without clarity on their final categorisation and the specific duties they will face, companies are left in a state of limbo, unable to make informed investment decisions. This is particularly challenging for smaller firms and start-ups, who lack the resources to prepare for multiple potential regulatory scenarios.
Local Impact
While the Online Safety Act is a piece of national legislation aimed at global companies, its effective implementation has a direct local impact. The delay means that UK users will have to wait longer for the full suite of protections promised by the Act to come into force. This includes stronger measures to tackle online fraud, greater transparency from platforms about the risks of their services, and more tools for users to control the content they see. For parents, schools, and community groups concerned about the impact of harmful content on young people, this delay will be a source of deep frustration and disappointment. It prolongs the period in which they must rely on the platforms' own voluntary measures, which the Act itself deemed insufficient.
What's Next
Ofcom will now proceed with its revised timeline, with the representations process for companies earmarked for early 2026 being the next key milestone. The outcome of the Wikimedia legal challenge will be watched closely, as it could set an important precedent for future disputes. Tech companies and their advisors will need to continue to engage closely with Ofcom's ongoing consultations and prepare for a phased implementation of the Act that will now stretch well into 2027. The government, meanwhile, will be under pressure to ensure that the delays do not derail the entire project and that Ofcom has the resources and legal backing it needs to see this complex task through to completion.
